Give a different error message if authentication succeeds but authorization fails.

Added a new "authz" parameter for FAIL result in the auth protocol for this.

--HG--
branch : HEAD

diff --git a/doc/auth-protocol.txt b/doc/auth-protocol.txt
index 1a6ff5e6d12dd49da48d5d7e7ce62355cb4be81e..bfcebd83c3f3a24ff14ff1034fa20a8990ba3e34 100644 (file)
--- a/doc/auth-protocol.txt
+++ b/doc/auth-protocol.txt
@@ -111,12 +111,18 @@ AUTH parameters are:
                       security holes if user-given data is directly put to
                       base64 string without filtering out tabs.
 
-FAIL parameters may contain "reason=.." parameter which should be sent to
-remote user instead of a standard "Authentication failed" message. For
-example "invalid base64 data". It should NOT be used to give exact reason
-for authentication failure (ie. "user not found" vs. "password mismatch").
-Sending "temp" parameter indicates that the error was a temporary internal
-failure, eg. connection was lost to SQL database.
+FAIL parameters may contain:
+
+ - reason=<str> : <str> should be sent to remote user instead of the standard
+                  "Authentication failed" messages. For example "invalid base64
+                 data". It must NOT be used to give exact reason for
+                 authentication failure (i.e. "user not found" vs. "password
+                 mismatch").
+ - temp         : This is a temporary internal failure, e.g. connection was
+                  lost to SQL database.
+ - authz        : Authentication succeeded, but authorization failed (master
+                  user's password was ok, but destnation user was not ok).
+                 Added in Dovecot v1.2.
 
 CONT command means that the authentication continues, and more data is
 expected from client to finish the authentication. Given base64 data should
@@ -124,7 +130,7 @@ be sent to client.
 
 FAIL and OK may contain multiple unspecified parameters which
 authentication client may handle specially. The only one specified here is
-"user=<userid>" parameter, which should always be sent if userid is known.
+"user=<userid>" parameter, which should always be sent if the userid is known.
 
 
 Server <-> Master

diff --git a/src/auth/auth-request-handler.c b/src/auth/auth-request-handler.c
index a06e0475541e3e18cef32d19e5d0329b184adebb..ca481f54e47c0f92d50b7b7bb866dae41d301e2e 100644 (file)
--- a/src/auth/auth-request-handler.c
+++ b/src/auth/auth-request-handler.c
@@ -237,8 +237,14 @@ static void auth_callback(struct auth_request *request,
                auth_stream_reply_add(reply, NULL, dec2str(request->id));
                if (request->user != NULL)
                        auth_stream_reply_add(reply, "user", request->user);
+
                if (request->internal_failure)
                        auth_stream_reply_add(reply, "temp", NULL);
+               else if (request->master_user != NULL) {
+                       /* authentication succeeded, but we can't log in
+                          as the wanted user */
+                       auth_stream_reply_add(reply, "authz", NULL);
+               }
                get_client_extra_fields(request, reply);
 
                auth_request_handle_failure(request, reply);

diff --git a/src/imap-login/client-authenticate.c b/src/imap-login/client-authenticate.c
index f1a2c379c84c1e1abb0804d992d8709538516d8d..7d6dc4af8a411127f20cbca6a1cddebd3f279d29 100644 (file)
--- a/src/imap-login/client-authenticate.c
+++ b/src/imap-login/client-authenticate.c
@@ -20,6 +20,8 @@
 
 #define IMAP_SERVICE_NAME "imap"
 #define IMAP_AUTH_FAILED_MSG "["IMAP_RESP_CODE_AUTHFAILED"] "AUTH_FAILED_MSG
+#define IMAP_AUTHZ_FAILED_MSG \
+       "["IMAP_RESP_CODE_AUTHZFAILED"] Authorization failed"
 
 const char *client_authenticate_get_capabilities(bool secured)
 {
@@ -95,6 +97,7 @@ static bool client_handle_args(struct imap_client *client,
        string_t *reply;
        unsigned int port = 143;
        bool proxy = FALSE, temp = FALSE, nologin = !success, proxy_self;
+       bool authz_failure = FALSE;
 
        for (; *args != NULL; args++) {
                if (strcmp(*args, "nologin") == 0)
@@ -103,6 +106,8 @@ static bool client_handle_args(struct imap_client *client,
                        proxy = TRUE;
                else if (strcmp(*args, "temp") == 0)
                        temp = TRUE;
+               else if (strcmp(*args, "authz") == 0)
+                       authz_failure = TRUE;
                else if (strncmp(*args, "reason=", 7) == 0)
                        reason = *args + 7;
                else if (strncmp(*args, "host=", 5) == 0)
@@ -183,6 +188,8 @@ static bool client_handle_args(struct imap_client *client,
                else if (temp || proxy_self) {
                        str_append(reply, "NO ["IMAP_RESP_CODE_UNAVAILABLE"] "
                                   AUTH_TEMP_FAILED_MSG);
+               } else if (authz_failure) {
+                       str_append(reply, "NO "IMAP_AUTHZ_FAILED_MSG);
                } else {
                        str_append(reply, "NO "IMAP_AUTH_FAILED_MSG);
                }